Summary
The connection teardown path touches subscribed_channels concurrently with pub/sub operations; the code itself carries an acknowledged Fixme.
Details
src/redis_connection_context.cpp:39:
// Fixme(zkl): risk of data race for subscribed_channels
The destructor unsubscribes the connection from PubSubManager while a concurrent PUBLISH delivery (which walks subscriber lists and writes directly to sockets, src/pub_sub_manager.cpp) or a SUBSCRIBE/UNSUBSCRIBE on another bthread may access the same container.
Impact
Use-after-free / torn container state on connection close under pub/sub load — rare but crash-class.
Suggested fix
Move ownership of the subscription set fully behind PubSubManager's lock (the connection keeping only an opaque handle), or take the manager's mutex around destructor cleanup and delivery consistently.
Found during the module-docs review (#492); see docs/04-scripting-pubsub-blocking.md Gotchas.
🤖 Found with Claude Code
Summary
The connection teardown path touches
subscribed_channelsconcurrently with pub/sub operations; the code itself carries an acknowledged Fixme.Details
src/redis_connection_context.cpp:39:// Fixme(zkl): risk of data race for subscribed_channelsThe destructor unsubscribes the connection from
PubSubManagerwhile a concurrent PUBLISH delivery (which walks subscriber lists and writes directly to sockets,src/pub_sub_manager.cpp) or a SUBSCRIBE/UNSUBSCRIBE on another bthread may access the same container.Impact
Use-after-free / torn container state on connection close under pub/sub load — rare but crash-class.
Suggested fix
Move ownership of the subscription set fully behind
PubSubManager's lock (the connection keeping only an opaque handle), or take the manager's mutex around destructor cleanup and delivery consistently.Found during the module-docs review (#492); see
docs/04-scripting-pubsub-blocking.mdGotchas.🤖 Found with Claude Code